Bump the npm-dependencies group with 3 updates

[dependabot]

Bumps the npm-dependencies group with 3 updates: enhanced-resolve, lightningcss and postcss.

Updates enhanced-resolve from 5.24.2 to 5.24.3

Release notes

Sourced from enhanced-resolve's releases.

v5.24.3

Patch Changes

• Resolve tsconfig extends package specifiers from ancestor node_modules directories (workspace hoisting). (by @​alexander-akait in #631)

Changelog

Sourced from enhanced-resolve's changelog.

5.24.3

Patch Changes

• Resolve tsconfig extends package specifiers from ancestor node_modules directories (workspace hoisting). (by @​alexander-akait in #631)

Commits

• b37222e chore(release): new release (#632)
• d50e202 fix: resolve tsconfig extends packages from ancestor node_modules (#631)
• See full diff in compare view

Updates lightningcss from 1.32.0 to 1.33.0

Release notes

Sourced from lightningcss's releases.

v1.33.0

Added

• Add support for ::highlight by @​lucasweng in parcel-bundler/lightningcss#970
• Add support for @​position-try at-rule by @​mattcosta7 in parcel-bundler/lightningcss#1238 #851
• Add support for ::search-text and :current::search-text (#1212) by @​lucinadin in parcel-bundler/lightningcss#1213
• Collapse light-dark(x, x) to x by @​cscnk52 in parcel-bundler/lightningcss#1183
• Supports :target-before/after/current pseudo-class by @​yisibl in parcel-bundler/lightningcss#1185
• Support for the alpha() relative color function by @​yisibl in parcel-bundler/lightningcss#1266

Fixed

• Print unknown at-rules in the same location by @​RobinMalfait in parcel-bundler/lightningcss#1233
• Fix #rrggbbaa support on older versions of android by @​fkeiler in parcel-bundler/lightningcss#1198
• Replace atty with std::io::IsTerminal by @​fkeiler in parcel-bundler/lightningcss#1197
• Bump dependencies (cssparser, const-str) by @​noahbald in parcel-bundler/lightningcss#1200
• Fix minification of negative scientific notation dimensions by @​ssssota in parcel-bundler/lightningcss#1192
• Change serde attribute to be conditional for ResolveResult enum File variant by @​FlorianDevP in parcel-bundler/lightningcss#1251
• Add external to return type of resolve by @​sapphi-red in parcel-bundler/lightningcss#1261

Commits

• c6a0c3c bump rust toolchain
• 1d680fa v1.33.0
• eda315f update ast
• e575845 update compat data
• 91bfa3f Support for the alpha() relative color function (#1266)
• 0f44690 perf: add conditional rule CodSpeed benchmark (#1271)
• a55b05d ci(perf): Add CodSpeed benchmarks (#1243)
• ee703ba fix(types): add external to return type of resolve (#1261)
• ec16529 ci: add permissions: contents: read to test (#1253)
• faf2ca8 Fix conditional serde attribute for ResolveResult enum File variant (#1251)
• Additional commits viewable in compare view

Updates postcss from 8.5.19 to 8.5.20

Release notes

Sourced from postcss's releases.

8.5.20

• Fixed missing space if AtRule#params is set after (by @​sarathfrancis90).
• Fixed mixing AST error on warnings (by @​MahinAnowar).

Changelog

Sourced from postcss's changelog.

8.5.20

• Fixed missing space if AtRule#params is set after (by @​sarathfrancis90).
• Fixed mixing AST error on warnings (by @​MahinAnowar).

Commits

• c4ac725 Release 8.5.20 version
• c30586d Fix missing space when AtRule#params is set after parsing (#2113)
• 5bfc3b9 Update dependencies
• 24733fd Move back to latest 11 pnpm
• 728127c Update pnpm to check that CI is fixed
• 806fe21 Rebuild nodes from another PostCSS copy in Warning (#2112)
• 337cb7e Improve CI security
• 7a8ca2d Remove patch after updating dependency
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[deepsource-io]

DeepSource Code Review

We reviewed changes in aa10215...ca092dd on this pull request. Below is the summary for the review, and you can see the individual issues we found as inline review comments.

See full review on DeepSource ↗

PR Report Card

Overall Grade

Security   Reliability   Complexity   Hygiene

Code Review Summary

Analyzer	Status	Updated (UTC)	Details
JavaScript		Jul 27, 2026 10:25a.m.	Review ↗
Secrets		Jul 27, 2026 10:25a.m.	Review ↗

---

Important

AI Review is run only on demand for your team. We're only showing results of static analysis review right now. To trigger AI Review, comment @deepsourcebot review on this thread.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​lightningcss@​1.33.0
	npm/​postcss@​8.5.19 ⏵ 8.5.20	+1		+1
	npm/​enhanced-resolve@​5.24.2 ⏵ 5.24.3	+1

View full report